//go:build linux

package cgroup

import (
	"errors"
	"os/exec"
	"syscall"
)

// setInto arms cmd for clone3-into-cgroup without clobbering any
// SysProcAttr build() already configured (Setpgid, Pdeathsig, ...) — build()
// owns all Cmd configuration; Start only adds to it, never replaces it.
// Only the strict claims path ((*Prepared).Start) places with clone3 now;
// the Manager's starts place through the shim and never set these fields.
func setInto(cmd *exec.Cmd, fd int) {
	if cmd.SysProcAttr == nil {
		cmd.SysProcAttr = &syscall.SysProcAttr{}
	}
	cmd.SysProcAttr.UseCgroupFD = true
	cmd.SysProcAttr.CgroupFD = fd
}

// shouldLatch reports whether err proves clone3-into-cgroup is unavailable
// for the life of this process — EPERM (a seccomp filter predating clone3,
// or one that forbids it outright) and ENOSYS (a kernel predating clone3,
// or RestrictNamespaces=yes's filter) mean the mechanism itself is gone;
// EINVAL means the kernel understood clone3 but rejected CLONE_INTO_CGROUP.
// The strict claims path answers ErrStrictUnsupported for these. Anything
// else (e.g. ENOENT or ENODEV from the cgroup dir disappearing) is
// spawn-specific and says nothing about the mechanism.
func shouldLatch(err error) bool {
	return errors.Is(err, syscall.EPERM) || errors.Is(err, syscall.ENOSYS) || errors.Is(err, syscall.EINVAL)
}